IONAMIN 


3 1761 —— 6 


Information and Privacy 
Commissioner/Ontario 


Commissaire a |'information 
et a la protection de la vie privée/Ontario 


elt 
Yi 


larly the implications of the Act on the issue of HIV/AIDS: related 
M information i. in ‘the ie workplace, 


... Summary of Workplace Privacy Principles 
on next page ... 


80 Bloor Street West, 
Suite 1700, 

Toronto, Ontario 
M5S 2V1 


Fax: 416 965-2983 
1-800-387-0073 
Tel: 416 326-3333 


~— 2 


Digitized by the Internet Archive 
in 2023 with funding from 
University of Toronto 


httos://archive.org/details/31/61119735686 


I. The Freedom of Information and Protection of Privacy Act, 1987 does not provide grounds for the mandatory 
collection of HIV/AIDS-related personal information; nor does it require employees to provide such information 
as a condition of securing or continuing employment. 


1. Mandatory HIV antibody testing of prospective or current employees is not permitted. 


2. Employees or persons seeking employment are under no obligation to disclose HIV/AIDS-related personal 
information to obtain or continue employment. 


3. Employees have no right to acquire HIV/AIDS-related personal information about their co-workers. 
Employers have no right to disclose such information to an infected employee’s co-workers. 


IT. Since knowledge generally leads to greater understanding of any subject, employees need to learn the facts about 
HIV/AIDS: how the disease is transmitted; the possible consequences of improper collection, use and disclosure 
of HIV/AIDS-related personal information; and the protection provided by the Act for such personal information. 


4. Employers should educate employees about the nature of HIV/AIDS, the consequences of mishandling HIV/ 
AIDS-related personal information for the affected person, and the obligations imposed by legislation, con- 
stitutional guarantees and general privacy principles about the handling of HIV/AIDS-related personal in- 
formation. 


III. HIV/AIDS-related personal information that is volunteered by the infected person should generally not be 
retained. Anyone receiving HIV/AIDs-related personal information should use extreme caution in order to 
prevent disclosure to other workers. Any such information volunteered by a third party should be disregarded. 


5. Information volunteered by a person about him or herself should only be retained where it meets criteria 
similar to those that apply under subsection 38(2) of the Act, with respect to the collection of personal 
information. HIV/AIDS-related personal information should be retained only if at least one of the following 
three criteria is satisfied: 


i. retention is expressly authorized by statute 
ii. retention is necessary for the purposes of law enforcement 
iii. retention is necessary to the proper administration of a lawfully authorized activity. 


6. HIV/AIDS-related personal information that is volunteered about an employee by a third party should not 
be collected, used, disclosed or retained by an employer. 


IV. Collecting highly sensitive personal information imposes corresponding obligations to safeguard this 
information from improper or unnecessary use or disclosure. If HIV/AIDS-related personal information has been 
collected, it is imperative that strict security measures be taken to ensure its confidentiality. 


7. Employers who collect HIV/AIDS-related personal information should ensure that strict security precau- 
tions are taken to protect the information from accidental or unauthorized use or disclosure. 
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if jet Beate ue on HIV/AIDS-related personal information must remain aware of the limitations 
Re . rimarily, they must be wary of using negative test results that may be outdated. They 

“SO remain aware of other deficiencies in findings of seropositivity and, particularly, seronegativity, that may 
make it risky to rely on certain test results to make decisions. 


8. Employers should be aware of the risk that a person who has received a negative HIV antibody test may 
subsequently become seropositive, and that the statistical probability of this happening may increase over 


fai aie should also be aware of other deficiencies inherent in both positive and negative antibody 
est results, 


VI. Given the sensitive nature of HIV/AIDS-related personal information, it is vital that the person affected be 
permitted to gain access to his or her records containing such information, and challenge their accuracy if 
necessary. The Act permits only limited exceptions to this general rule. 


9. Workplace policies should state that employees generally havea right of access to HIV/AIDS-related personal 
information under subsection 47(1) of the Freedom of Information and Protection of Privacy Act, 1987. These 
policies should also set out their rights under subsection 47(2) to request correction of the information, 
require the insertion of a statement of disagreement, and require other bodies to be notified of the correction 
or statement of disagreement. 


VII. The Act requires that a number of restrictions must apply to the use of HIV/AIDS-related personal 
information. 


10. Under section 41 of the Freedom of Information and Protection of Privacy Act, 1987, HTV/AIDS-related personal 
information may only be used in the following circumstances: 


- where the person to whom the information relates has identified that information in particular and 
consented to its use 

- for the purpose for which it was obtained or compiled 

- for a purpose consistent with the purpose for which it was obtained or compiled 

- fora purpose for which the information may be disclosed to the institution under section 42 of the Act. 


Due to the extreme sensitivity of HIV/AIDS-related personal information, we recommend that the approval 
ofthe head ofthe institution (or his/her designate) be obtained in determining what constitutes a “consistent 


purpose” under section 41. 


VIII. Just as the Act contains provisions which apply to the collection and retention of HIV/AIDS-related 
personal information, it also addresses the disclosure of HIV/AIDS-related personal information. Employers 
must not disclose such information, except in accordance with section 42 of the Act. 


11. Employers must not disclose HIV/AIDS-related personal information, except in accordance with section 42 


of the Freedom of Information and Protection of Privacy Act, 1987. In some cases, the disclosure provisions of 
section 42 should be supplemented to require the consent of the affected person, or where the person does 
not or cannot consent, the approval of the head (or his/her designate) of the affected institution. 


When deciding whether to approve disclosure, the head of an institution (or his/her designate) should 


consider the following: 


12. 


- why disclosure is necessary . 
- the potential adverse consequences for the person to whom the information relates 


the likelihood that the requester of the information will maintain its confidentiality 
the likelihood that the requester will use it only for the purpose for which it is being sought 


how accurate and up to date the information is. 
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